chore(data): stop tracking runtime-refreshed whitelist seeds

The Cloudflare ips-v4/v6.txt and paloalto/.gitkeep were git-tracked. The
Cloudflare files are overwritten at runtime by every whitelist refresh, so on
a deployed server they become locally-modified tracked files that make 'git pull'
conflict. Keep the read-only paloalto/scanner-ips.txt seed tracked; ignore the
rest (they are re-downloaded if absent; built-in ranges are the fallback).

.gitignore

@@ -13,12 +13,14 @@ __pycache__/
 # python virtual environment
 .venv/
 
-# app runtime data (feeds, caches, scan state - regenerated each run)
-# matched per-entry (not as a directory) so the whitelist seed files
-# for Cloudflare and PaloAlto below can be re-included
+# app runtime data (feeds, caches, scan state - regenerated each run).
+# All of this must stay UNTRACKED so ``git pull`` never conflicts with files a
+# scan has written since the last pull (see .github/instructions/DEPLOYMENT.md).
+# The single allowed tracked seed is the read-only PaloAlto scanner-ips.txt
+# (never rewritten at runtime); the Cloudflare ips-*.txt are runtime-refreshed
+# downloads, so they are NOT tracked and are re-downloaded if absent.
 app/data/*
-!app/data/cloudflare/
-!app/data/paloalto/
+!app/data/paloalto/scanner-ips.txt
 
 # SQLite database (canonical store) + WAL/SHM sidecars
 app/data/*.db